Commit Graph

492 Commits

Author SHA1 Message Date
Chen Qi
9025527f4c libgssglue: switch to use git source
The 0.8 orig.tar.gz is not in debian mirror any more. In fact, we
really should avoid using orig.tar.gz like this because distros
like debian will just delete those that they don't maintain any more.

Switch to use git source.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit baaafdf08b)
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2025-11-22 16:08:13 +02:00
Jeremy A. Puhlman
f4ef325fc3 Check for usrmerge before removing /usr/lib
Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-03-27 12:36:58 -04:00
Armin Kuster
6cf4d653dc libgssglue: update to 0.8
LICENSE changed
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-29 09:09:30 -05:00
Lei Maohui
830817cc14 paxctl: Fix do_package QA Issue.
After usrmerge had been enabled, paxctl has the fowllowing error:
ERROR: paxctl-0.9-r0 do_package: QA Issue: paxctl: Files/directories were installed but not shipped in any package:
  /sbin/paxctl

Signed-off-by: Lei Maohui <leimaohui@fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-08 12:06:31 -04:00
Armin Kuster
02f285b276 sshguard: Update to 2.4.3
Changelog: https://bitbucket.org/sshguard/sshguard/src/master/CHANGELOG.rst

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-06 11:31:18 -04:00
Luke Granger-Brown
21bb5627e0 glome: update to tip
Markus Rudy (17):
      Use Github TeX Markdown instead of image includes.
      Merge pull request #134 from burgerdev/md-tex
      Merge pull request #135 from vvidic/cli-base64
      RFD 002: public key format at rest (#109)
      Merge pull request #137 from vvidic/hmac
      Merge pull request #138 from vvidic/hmac2
      Update list of supported Python versions
      Install golint instead of 'get'ting it.
      Merge pull request #139 from burgerdev/actions
      Clarify format of public key at rest
      Test all supported config file keys
      Merge pull request #144 from burgerdev/public-key-format
      Fix linter findings for #144
      Use 'release' buildtype for NixOS builds
      Merge pull request #149 from google/l9i/bye-java
      RFD 001: GLOME Login v2 (#102)
      login/v2 implementation for Go (#162)

Philipp Kern (21):
      Merge pull request #133 from google/l9i/pam-fix
      Merge pull request #132 from google/l9i/nix-shell
      Merge pull request #140 from vvidic/defaul-typo
      Merge pull request #142 from vvidic/soversion
      Merge pull request #146 from burgerdev/lint
      Merge pull request #148 from google/dependabot/go_modules/go/golang.org/x/crypto-0.1.0
      Merge pull request #152 from google/l9i/cpplint
      Merge pull request #154 from vvidic/docker-public-key
      Merge pull request #155 from vvidic/prompt-fix
      Insert a slash after url-prefix when writing it into prompt
      Merge pull request #156 from google/url-prefix-compat
      Merge pull request #157 from vvidic/config-order
      State that devices require randomness for the protocol to work
      Update docs/protocol.md
      Merge pull request #158 from google/pkern-patch-1
      Fix error to state "at most" instead of "at least"
      Merge pull request #153 from vvidic/min-tag-length
      Merge pull request #159 from vvidic/host-id-type
      README.md: Codeblock fixups
      Merge branch 'master' into l9i/README
      Merge pull request #141 from google/l9i/README

Piotr Lewandowski (12):
      Fix failing PAM test
      Treat warning as errors
      Define OPENSSL_API_COMPAT to require OpenSSL >=1.1
      Use werror only for CI
      Add nix-shell config for setting up dev environment
      Add GitHub Action workflow for shell.nix
      Add intro and installation steps to README.md
      Address reviewer's comments
      Wrap lines
      Delete Java implementation
      Rename `url-prefix` to `prompt` (#131)
      Add `cpplint` linter

Valentin Vidic (10):
      Update CLI to use base64 instead of hex tags.
      Replace deprecated OpenSSL HMAC API with EVP.
      Replace OpenSSL EVP_DigestSign API with HMAC()
      Fix typo: defaul => default
      Use project version in library version
      Update Docker scripts for new public key format
      Fix setting of prompt parameter
      Parse command line again after reading the config
      Add config option for minimum authcode length #122
      Add config option for host-id type #122

dependabot[bot] (1):
      Bump golang.org/x/crypto in /go

Signed-off-by: Luke Granger-Brown <lukegb@google.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-06 11:31:18 -04:00
Armin Kuster
1dd076d3a7 firejail: only allow x86-64 and arm64 to build
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-31 06:18:52 -04:00
Martin Jansa
df8a1eb479 *.patch: fix malformed Upstream-Status and SOB lines
* as reported by openembedded-core/scripts/contrib/patchreview.py -v .

Malformed Signed-off-by 'Signed-Off-By:' (./recipes-mac/AppArmor/files/crosscompile_perl_bindings.patch)
Malformed Signed-off-by 'Signed-Off-By:' (./recipes-mac/AppArmor/files/disable_perl_h_check.patch)

Missing Upstream-Status tag (./recipes-compliance/scap-security-guide/files/0001-standard.profile-expand-checks.patch)

Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-ids/samhain/files/samhain-not-run-ptest-on-host.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-ids/samhain/files/samhain-pid-path.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-ids/suricata/files/fixup.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-scanners/clamav/files/fix2_libcurl_check.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-security/isic/files/configure_fix.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-security/krill/files/panic_workaround.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-security/opendnssec/files/libdns_conf_fix.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-security/opendnssec/files/libxml2_conf.patch

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-25 15:05:28 -04:00
Armin Kuster
2eb05e11c0 isic: fine tune Upstream-Status
These are changes I did so apply the appropriate label.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-25 15:05:28 -04:00
Martin Jansa
ea97a23986 *.patch: add Upstream-Status to all patches
There is new patch-status QA check in oe-core:
https://git.openembedded.org/openembedded-core/commit/?id=76a685bfcf927593eac67157762a53259089ea8a

This is temporary work around just to hide _many_ warnings from
optional patch-status (if you add it to WARN_QA).

This just added
Upstream-Status: Pending
everywhere without actually investigating what's the proper status.

This is just to hide current QA warnings and to catch new .patch files being
added without Upstream-Status, but the number of Pending patches is now terrible:

0 (0%)  	meta-parsec
N/A (0%)        meta-hardening
1 (100%)        meta-integrity
15 (68%)        meta-tpm
27 (61%)        meta-security

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-25 15:05:28 -04:00
Adrian Zaharia
10a2c9505c libmhash: fix multilib header conflict - mutils/mhash_config.h
Header file conflict between 32-bit and 64-bit versions

Signed-off-by: Adrian Zaharia <Adrian.Zaharia@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-06 07:54:09 -04:00
Armin Kuster
ae23806825 fscryptctl: update to 1.0.1
Don't build man as it needs pandoc

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-06 07:54:09 -04:00
Armin Kuster
415424a706 krill: forced to inclued fetch hashes.
Now manditory via Poky commit: https://git.yoctoproject.org/poky/commit/bitbake/lib/bb/fetch2?id=4d9886e1435dba3785973cc920865f8ab67e644d

used cargo-update-recipe-crates to fixup

Drop krill.inc in favor of new crate file name

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-08 10:49:38 -04:00
Armin Kuster
6f7c5fe13f cryptmout: update to 6.2.0
Change LIC_FILES_CHKSUM to use COPYING

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-20 16:30:29 -04:00
Armin Kuster
883d5e4dd9 krill: update 0.12.3
refresh patch

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-20 16:30:29 -04:00
Armin Kuster
90feb1888d firejail: update 0.9.72
refresh patch

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-20 16:30:29 -04:00
Armin Kuster
d440752461 libmspack: update to 1.11
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-20 16:30:29 -04:00
Armin Kuster
206260ffd0 fscrypt: update to 1.1.0
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-20 16:30:15 -04:00
Markus Volk
d623fc232b bubblewrap: remove recipe
It was moved to meta-oe.

Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-04 10:46:25 -05:00
Alex Kiernan
f991b20f56 bubblewrap: Update 0.6.2 -> 0.7.0
Inherit github-releases so that `devtool upgrade` can identify new
versions correctly.

Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-11-19 14:01:41 -05:00
Armin Kuster
2893be10d0 chipsec: update to 1.9.1
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-11-19 14:01:41 -05:00
Armin Kuster
e8e7318189 cryptmount: update to 6.0
LIC_FILES_CHKSUM changed do to yr change
Drop patch remove_linux_fs.patch

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-09-25 15:19:51 -04:00
Armin Kuster
b29ce7d47d libgssglue: update to 0.7
LIC_FILE_CHKSUM changes to to indentations changes.
use bootstrap to setup config properly.

Drop libgssglue-fix-CVE-2011-2709.patch, libgssglue-g-initialize.patch now included in update.
  and ibgssglue-mglueP.patch now included in update.

Drop libgssglue-gss-inq-cred.patch still pending after 5 yrs.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-09-25 13:37:57 -04:00
Armin Kuster
824d2762f6 update chipsec to 1.8.8
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-09-12 11:11:50 -04:00
Armin Kuster
ee8a51c582 cryptmount: fix systemd service install
Default is to install the service in /usr/lib

Signed-off-by: Armin Kuster <akuster808@gmail.com>

--
[V2]
Fix typo in subject
2022-09-12 11:11:50 -04:00
Armin Kuster
aa57a13788 cyptmount: Fix mount.h conflicts seen with glibc 2.36+
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-25 08:15:58 -04:00
John Edward Broadbent
571af37e9c meta-security: Add recipe for Glome
Generic Low Overhead Message Exchange (GLOME) is a protocol providing
secure authentication and authorization for low dependency environments.

Signed-off-by: John Edward Broadbent <jebr@google.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-12 08:32:51 -07:00
Armin Kuster
8e26e9dc7a cryptmount: Add new pkg
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-12 08:32:51 -07:00
Armin Kuster
70859e8608 krill: only builds on x86/x86-64 and arm64
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-02 13:45:26 -07:00
Armin Kuster
3ccc0bf68a krill: update to 0.9.6
add UPGRADE_CHECK vars

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-02 13:45:26 -07:00
Armin Kuster
522c08e98d ecryptfs-utils: add UPSTREAM_CHECK_URI
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-02 13:45:26 -07:00
Armin Kuster
8cf673deaa chipsec: update to 1.8.7
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-30 14:11:27 -07:00
Alex Kiernan
f4a4c902ed bubblewrap: Add recipe
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
2022-07-30 14:11:27 -07:00
Armin Kuster
a87a1a3e7c chipsec: update to 1.8.5
minor recipe cleanup

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-23 18:47:59 -07:00
Armin Kuster
a68a46ded9 packagegroup-core-security: skip mips firejail
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-23 18:47:59 -07:00
Armin Kuster
fec94e6ce4 firejail: Add new package
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-23 18:47:59 -07:00
Armin Kuster
80bc8b7133 libmhash: add native pkg support
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-23 18:47:59 -07:00
Armin Kuster
db3a3e87a6 sssd:move to dynamic networking-layer
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-18 06:48:22 -07:00
Armin Kuster
a764533c20 meta-security: move perl and python recipes to dynamic layers structure
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-14 10:51:32 -07:00
Armin Kuster
20c13f6335 fscrypt: add distro_check on pam
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-14 10:51:32 -07:00
Joe Slater
93f2146211 LICENSE: update to SPDX standard names
Use convert-spdx-licenses.py to update LICENSE in recipes.

Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-13 13:45:44 -07:00
Davide Gardenal
498ca39cd6 fscrypt: update dependecy from go-dep-native to go-native
Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-07 10:26:45 -07:00
Armin Kuster
2be1d069ec python3-fail2ban: fix compile issue on some hosts
Use python3-native to use 2to3

Fix build issue on some hosts with this error:
 (result, consumed) = self._buffer_decode(data, self.errors, final)
 | UnicodeDecodeError: 'utf-8' codec can't decode byte 0xd8 in position 152: invalid continuation byte

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-02 11:21:42 -07:00
Robert Yang
0c41d792cf LICENSE: adopt SPDX standard names
Modify LICENSE for ding-libs and libmhash.

Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-02 11:21:42 -07:00
Ashish Sharma
c56ae450c9 meta-security : Use SPDX style licensing format
WARNING: selinux-sandbox-3.3-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPLv2+ [obsolete-license] \
WARNING: selinux-gui-3.3-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPLv2+ [obsolete-license] \
WARNING: semodule-utils-3.3-r0.1 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPLv2+ [obsolete-license] \
WARNING: selinux-dbus-3.3-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPLv2+ [obsolete-license] \
WARNING: libwhisker2-perl-2.5-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPL-1.0+ [obsolete-license] \
WARNING: lib-perl-0.63-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPL-1.0+ [obsolete-license] \
WARNING: libhtp-0.5.39-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPLv2 [obsolete-license] \
...

Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-02 11:21:42 -07:00
Armin Kuster
288391edc5 python3-privacyidea: drop old package ref.
meta-python dropped package via commit:

620689d4efba28bc8dd60e2d82908bfb3531fbd0
python3-backports-functional-lru-cache: remove, not needed for Python 3

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-13 08:11:21 -07:00
Ashish Sharma
e5e3dd4877 Subject: [PATCH] Subject: python3-fail2ban: switch to legacy setuptools3
raise InvalidWheelFilename(f"{filename} is not a valid wheel filename.")
pip._internal.exceptions.InvalidWheelFilename: fail2ban-*-*.whl is not a valid wheel filename.
Removed build tracker: '/tmp/pip-req-tracker-qnepnk46'

ERROR: Failed to pip install wheel. Check the logs.

Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:13:15 -08:00
Armin Kuster
30f34fa990 python3-fail2ban: fix SPDX license.
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:12:56 -08:00
Armin Kuster
be65e1c3ba python3-privacyidea: update to 3.6.2
Fix license.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:08:22 -08:00
Armin Kuster
dac1280dee python3-privacyidea: fix QA ERROR
ERROR: python3-privacyidea-3.5.2-r0 do_package: QA Issue: python3-privacyidea: Files/directories were installed but not shipped in any package:
/usr/etc
/usr/etc/privacyidea
/usr/etc/privacyidea/dictionary
/usr/etc/privacyidea/privacyideaapp.wsgi

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:08:22 -08:00